# Ondemand httpd ssl issue

**URL:** <https://discourse.openondemand.org/t/ondemand-httpd-ssl-issue/3038>\
**Category:** Get Help\
**Created:** [October 22, 2023, 12:07pm UTC](https://discourse.openondemand.org/t/ondemand-httpd-ssl-issue/3038 "2023-10-22T12:07:29Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![prod-feng](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/prod-feng/32/1931_2.png) [@prod-feng](https://discourse.openondemand.org/u/prod-feng)\
**Post date:** [October 22, 2023, 12:07pm UTC](https://discourse.openondemand.org/t/ondemand-httpd-ssl-issue/3038/1 "2023-10-22T12:07:29Z")

</div>

Hi everyone,

I am trying to install Open OnDemand on our login node of our cluster. I have issue to enable the https port.

The system we use is: Rocky Linux release 8.4, ondemand-3.0.3-1.el8.x86\_64, ondemand-dex-2.36.0-1.el8.x86\_64.

I am setting up using ondemand-dex with LDAP.

There is also an issue to use LDAP. Now I need help first on the SSL/HTTPS.

The HTTP/80 seems works fine, while after I enabled the SSL/HTTPS, when I tried to open the ondemand webportal on a different computer, it directs me to: https:/myserverhere/pun/sys/dashboard, and reports 500 error:

===================================

" Internal Server Error

The server encountered an internal error or misconfiguration and was unable to complete your request.

Please contact the server administrator at root@localhost to inform them of the time this error occurred, and the actions you performed just before this error.

More information about this error may be available in the server error lo"

===================================

The strange thing is, that I can manually to open the following link:

[https://myserver](https://myserver) here:5554/auth/ldap/login?back=&state=lzixgjlc7xxxu

or even I can open  
[http://myserverhere:5556/auth/ldap/login?back=&state=lzixgjlc7xxxuilzf](http://myserverhere:5556/auth/ldap/login?back=&state=lzixgjlc7xxxuilzf)

The contents of ood\_portal.yml look like:

servername: ‘myserverhere’  
ssl:  
- ‘SSLCertificateFile “/etc/pki/tls/certs/ondemand.crt”’  
- 'SSLCertificateKeyFile “/etc/pki/tls/private/ondemand.key”  
dex\_uri: false

dex:  
ssl: true  
http\_port: “5556”  
https\_port: “5554”  
tls\_cert: /etc/ood/dex/ldap.pem  
tls\_key: /etc/ood/dex/ldap.key  
connectors:  
- type: ldap  
id: ldap  
name: LDAP  
config:  
host: ldapserver:636  
rootCA: /etc/ood/dex/ca.pem  
insecureSkipVerify: false  
bindDN: (hidden)  
bindPW: (hidden)  
userSearch:  
baseDN: (hidden)  
filter: (hidden)  
cn: uid  
username: uid  
idAttr: uid  
emailAttr: mail  
displayName: gecos  
preferredUsernameAttr: uid  
groupSearch:  
baseDN: (hidden)  
filter: (hidden)  
userMatchers:  
- userAttr: DN  
groupAttr: member  
gidNumber: gidNumber  
nameAttr: cn

Thanks in advance for your help!

Best,  
Feng

---

<div class="post-metadata">

**Author:** ![prod-feng](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/prod-feng/32/1931_2.png) [@prod-feng](https://discourse.openondemand.org/u/prod-feng)\
**Post date:** [October 23, 2023, 12:35am UTC](https://discourse.openondemand.org/t/ondemand-httpd-ssl-issue/3038/2 "2023-10-23T00:35:11Z")

</div>

OK, fit it by referecning the post: [Tried Dex again, help with openidc errors?](https://discourse.openondemand.org/t/tried-dex-again-help-with-openidc-errors/1745)

---

<div class="post-metadata">

**Author:** ![prod-feng](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/prod-feng/32/1931_2.png) [@prod-feng](https://discourse.openondemand.org/u/prod-feng)\
**Post date:** [October 23, 2023, 1:32pm UTC](https://discourse.openondemand.org/t/ondemand-httpd-ssl-issue/3038/3 "2023-10-23T13:32:59Z")

</div>

There is actually a second issue on the SSL:  
once I turned on  
dex\_uri: false  
https\_port: “5554”  
tls\_cert: /etc/ood/dex/ldap.pem  
tls\_key: /etc/ood/dex/ldap.key

My understanding is to set the above cert/key for dex to communicate with LDAP?

Any help is greatly appreciated.

Best,  
Feng

[Mon Oct 23 09:19:53.832771 2023] [auth\_openidc:error] [pid 3466587:tid 140736643467008] [client xxx:58409] oidc\_util\_http\_call: curl\_easy\_perform() failed on: [https://xxx:5554/.well-known/openid-configuration](https://xxx:5554/.well-known/openid-configuration) (SSL certificate problem: unable to get local issuer certificate)

[Mon Oct 23 09:19:53.832801 2023] [auth\_openidc:error] [pid 3466587:tid 140736643467008] [client xxx:58409] oidc\_provider\_static\_config: could not retrieve metadata from url: https:/xxxx:5554/.well-known/openid-configuration

[Mon Oct 23 09:20:45.596200 2023] [auth\_openidc:error] [pid 3466586:tid 140736635074304] [client xxx:58423] oidc\_util\_http\_call: curl\_easy\_perform() failed on: [https://xxx:5554/.well-known/openid-configuration](https://xxx:5554/.well-known/openid-configuration) (SSL certificate problem: unable to get local issuer certificate)

[Mon Oct 23 09:20:45.596233 2023] [auth\_openidc:error] [pid 3466586:tid 140736635074304] [client xxxx:58423] oidc\_provider\_static\_config: could not retrieve metadata from url: [https://xxxx:5554/.well-known/openid-configuration](https://xxxx:5554/.well-known/openid-configuration)

---

<div class="post-metadata">

**Author:** ![prod-feng](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/prod-feng/32/1931_2.png) [@prod-feng](https://discourse.openondemand.org/u/prod-feng)\
**Post date:** [October 23, 2023, 1:41pm UTC](https://discourse.openondemand.org/t/ondemand-httpd-ssl-issue/3038/4 "2023-10-23T13:41:59Z")

</div>

Without the tls\_cert and tls\_key, the login webpage can show up, but when try to login, for the error:

##### Internal Server Error

Login error: failed to connect: LDAP Result Code 200 “Network Error”: x509: certificate signed by unknown authority

Did I miss something?

---

<div class="post-metadata">

**Author:** ![prod-feng](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/prod-feng/32/1931_2.png) [@prod-feng](https://discourse.openondemand.org/u/prod-feng)\
**Post date:** [October 23, 2023, 2:22pm UTC](https://discourse.openondemand.org/t/ondemand-httpd-ssl-issue/3038/5 "2023-10-23T14:22:41Z")

</div>

The new error is:

Should we only use true certificate?

[Mon Oct 23 10:19:18.748661 2023] [auth\_openidc:error] [pid 3473232:tid 140736162928384] [client xx:58912] oidc\_util\_http\_call: curl\_easy\_perform() failed on: [https://xxxdex/.well-known/openid-configuration](https://xxxdex/.well-known/openid-configuration) (SSL certificate problem: self signed certificate)

[Mon Oct 23 10:19:18.748694 2023] [auth\_openidc:error] [pid 3473232:tid 140736162928384] [client xxx:58912] oidc\_provider\_static\_config: could not retrieve metadata from url: [https://xxx/dex/.well-known/openid-configuration](https://xxx/dex/.well-known/openid-configuration)

---

<div class="post-metadata">

**Author:** ![jeff.ohrstrom](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/jeff.ohrstrom/32/136_2.png) [@jeff.ohrstrom](https://discourse.openondemand.org/u/jeff.ohrstrom)\
**Post date:** [October 23, 2023, 3:46pm UTC](https://discourse.openondemand.org/t/ondemand-httpd-ssl-issue/3038/6 "2023-10-23T15:46:11Z")

</div>

> [@prod-feng](#):
>
> Should we only use true certificate?

Yes - both errors are from the certificates you’re using. Or more specifically - the certificate authority they were generated from. You need to use a real/valid certificate authority to generate the certificates. This certificate authority file has to exist on all the systems that will use it. I.e., the OOD server and the LDAP server.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex015/uploads/osc/original/2X/b/bae70bd0ed39a3ae769c2108155f4cb3e9da8385.png) [@system](https://discourse.openondemand.org/u/system)\
**Post date:** [April 20, 2024, 3:46pm UTC](https://discourse.openondemand.org/t/ondemand-httpd-ssl-issue/3038/7 "2024-04-20T15:46:14Z")

</div>

Closed on April 20, 2024, 3:46pm UTC

This topic was automatically closed 180 days after the last reply. New replies are no longer allowed.